qemu/qemu.git, branch stable-10.0

Update version for 10.0.13 release

2026-08-26T07:15:13+00:00

Signed-off-by: Michael Tokarev

target/riscv/tcg: sret in virtual user mode raises virtual instruction exception

2026-08-25T11:11:14+00:00

Currently, when a `sret` is executed in virtual user mode, qemu raise an `illegal instruction exception`, but in this case the correct behavior is to raise a `virtual instruction exception` and the code already contains a check to it, but it's not enough to catch. This patch is useful to improve the correctness of the virtualization of the risc v architecture. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3622 Signed-off-by: Christian S. Lima Reviewed-by: Alistair Francis Message-ID: <20260808031849.59726-1-christianslima@proton.me> Signed-off-by: Alistair Francis (cherry picked from commit 85d38315fd19cda7fcfec5350f27cdfa15742600) Signed-off-by: Michael Tokarev

target/riscv: enforce even register constraints for Zdinx fcvt pairs

2026-08-25T11:11:14+00:00

fcvt.d.h and fcvt.h.d access a 64-bit double held in a register pair, so under Zdinx/Zhinxmin the odd-rd (fcvt.d.h) and odd-rs1 (fcvt.h.d) encodings are reserved. Add the missing REQUIRE_EVEN checks so those encodings raise an illegal-instruction exception instead of retiring. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4109 Reviewed-by: Alistair Francis Signed-off-by: wangyang Message-ID: Signed-off-by: Alistair Francis (cherry picked from commit e68cc2e5cd28333ac76d757ed2db7d2f7635d09a) Signed-off-by: Michael Tokarev

target/riscv: reject FMV.X.W/FMV.W.X under Zfinx

2026-08-25T11:11:14+00:00

Zfinx explicitly excludes the FMV transfer instructions, but trans_fmv_x_w/trans_fmv_w_x used REQUIRE_ZFINX_OR_F so a Zfinx-only CPU accepted them. Require RVF instead so the transfers trap with an illegal instruction when only Zfinx is present. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4108 Reviewed-by: Alistair Francis Signed-off-by: wangyang Message-ID: <36c7cfebd27b4b6e8bcdd00e09e9dda0@wangyang25.otcaix.iscas.ac.cn> Signed-off-by: Alistair Francis (cherry picked from commit af1e669cef162e8d9b5f2f176e8b909d61c4b530) Signed-off-by: Michael Tokarev

target/riscv: honor zicbo* envcfg gating in linux-user mode

2026-08-25T11:11:14+00:00

In user-only builds check_zicbo_envcfg() skipped the envcfg check entirely (#if !defined(CONFIG_USER_ONLY)), so cbo.inval/cbo.flush/ cbo.zero retired unconditionally in linux-user even though the machine-level envcfg fields are never initialized. Give the user-mode build a senvcfg-based gate, and initialize SENVCFG_CBZE at reset when ext_zicboz is enabled so cbo.zero stays usable while cbo.inval/cbo.flush remain illegal, matching the user-mode view of a typical firmware/kernel setup. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4107 Reviewed-by: Alistair Francis Signed-off-by: wangyang Message-ID: <9b2f22fc402b48b8ba81f72be8ed04bc@wangyang25.otcaix.iscas.ac.cn> Signed-off-by: Alistair Francis (cherry picked from commit 12289f2f9a0f1ffa6a75c2b189a0273dc455dfb0) Signed-off-by: Michael Tokarev

disas/riscv: Fix typo in th.lbib format

2026-08-25T11:11:14+00:00

th.lbib should format the same as th.lbia, and the other increment insns, with the address register in parenthesis. Cc: qemu-stable@nongnu.org Fixes: 318df7238b9 ("disas/riscv: Add support for XThead* instructions") Reviewed-by: Alistair Francis Signed-off-by: Richard Henderson Message-ID: <20260812223142.349142-41-richard.henderson@linaro.org> Signed-off-by: Alistair Francis (cherry picked from commit ecbd3a031f12669da98cdf929cbc7dbb88d3450f) (Mjt: fix-up across v11.1.0-496-g7de6afd53186 "disas/riscv: Drop explicit zero of rv_opcode_data fields") Signed-off-by: Michael Tokarev

disas/riscv: Fix isa decoding of rev8

2026-08-25T11:11:14+00:00

The encoding of rev8 is different for rv32 and rv64. Cc: qemu-stable@nongnu.org Fixes: 02c1b569a15 ("disas/riscv: Add Zb[abcs] instructions") Reviewed-by: Alistair Francis Signed-off-by: Richard Henderson Message-ID: <20260812223142.349142-40-richard.henderson@linaro.org> Signed-off-by: Alistair Francis (cherry picked from commit d610e55c8390a8bfd15d0a4f1521d7fc46e4e0b7) Signed-off-by: Michael Tokarev

disas/riscv: Fix rv32 encoding of zext.h

2026-08-25T11:11:14+00:00

For rv64, pack with rs2 = 0 does not encode zext.h. Cc: qemu-stable@nongnu.org Fixes: 02c1b569a15 ("disas/riscv: Add Zb[abcs] instructions") Reviewed-by: Alistair Francis Signed-off-by: Richard Henderson Message-ID: <20260812223142.349142-39-richard.henderson@linaro.org> Signed-off-by: Alistair Francis (cherry picked from commit d4151cf2675124e26b3383ae06f7352a23f17399) Signed-off-by: Michael Tokarev

target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32

2026-08-25T11:11:14+00:00

The Zicfilp landing-pad enable (LPE, bit 2) and Zicfiss shadow-stack enable (SSE, bit 3) controls live in the low 32 bits of menvcfg and henvcfg, and the CFI specification defines them for both RV32 and RV64. QEMU only adds MENVCFG_LPE/MENVCFG_SSE (and the henvcfg equivalents) to the writable mask inside the "riscv_cpu_mxl(env) == MXL_RV64" block, so on RV32 these bits are silently dropped and the features cannot be enabled. This is inconsistent with write_senvcfg(), which already handles SENVCFG_LPE/SENVCFG_SSE regardless of MXLEN. Hoist the LPE/SSE mask handling out of the RV64-only block in write_menvcfg() and write_henvcfg() so the bits become writable on RV32 as well. The upper-half writers (write_menvcfgh/write_henvcfgh) are unaffected because these bits reside in the low 32 bits. Reproducible on qemu-system-riscv32 -cpu rv32,zicfilp=true,zicfiss=true: an M-mode write of menvcfg.{LPE,SSE} reads back as zero, while the same program on rv64 keeps the bits set. Fixes: 4923f672e3d7 ("target/riscv: Introduce elp state and enabling controls for zicfilp") Fixes: 8205bc127a83 ("target/riscv: introduce ssp and enabling controls for zicfiss") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4045 Signed-off-by: A-Shehab Reviewed-by: Daniel Henrique Barboza Message-ID: <20260726080537.13913-1-ahshehab24@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit bd1ee9ab3c39f269d8bea8acf83ea833a69a6e10) (Mjt: introduce `RISCVCPUConfig *cfg` variable in write_henvcfg() from v10.0.0-1878-gdff5f515409f "target/riscv: Enable/Disable S/VS-mode Timer when STCE bit is changed") Signed-off-by: Michael Tokarev

hw/riscv/riscv-iommu: preserve requested perm in spa_fetch()

2026-08-25T11:11:14+00:00

b18e3f0e2d0f fixed spa_fetch() faults whose TTYP used the leaf PTE permission instead of the original request permission. However, it kept that request-narrowed value in iotlb->perm after a successful walk, and riscv_iommu_translate() caches iotlb->perm for later accesses to the same IOVA. That means a write to an RW mapping can cache the entry as write-only. A later read then hits the cache and faults even though the mapping allows it, which showed up in NVMe testing as bogus completions and controller timeouts. Keep the requested permission in a separate req_perm and use it for all permission checks and fault-type decisions. Accumulate the leaf permissions separately and copy them to iotlb->perm only after the full walk succeeds, so cached entries describe the mapping rather than the current request. Since faults leave iotlb->perm as the original request, the S-stage and G-stage TTYP fixes remain intact. Fixes: b18e3f0e2d0f ("hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults") Fixes: 12422e1f4493 in 10.0.x Signed-off-by: Andrew Jones Reviewed-by: Daniel Henrique Barboza Message-ID: <20260717144525.1154204-1-andrew.jones@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit aa51eec004461f671f878145d3fc921c6cabee48) Signed-off-by: Michael Tokarev